Commonwealth Consolidated Acts Commonwealth Consolidated Acts(1) A person commits an offence if:
(a) the person uses information; and
(b) the person does so for a prohibited purpose, and the person knows or is reckless as to that fact; and
(c) the information is health information; and
(d) the information is or was included in a healthcare recipient's My Health Record; and
(e) the person is not the healthcare recipient.
Penalty: Imprisonment for 5 years or 300 penalty units, or both.
(2) Subsection (1) does not apply if the information was not collected from, and is not derived from a disclosure that was made by, a person who obtained the information by using or gaining access to the My Health Record system. For this purpose, it does not matter whether or not any collection or disclosure of the information was authorised under this Act or any other law.
Note: A defendant bears an evidential burden in relation to the matter in subsection (2): see subsection 13.3(3) of the Criminal Code .
(3) Strict liability applies to paragraphs (1)(d) and (e).
Note: For strict liability, see section 6.1 of the Criminal Code .
(4) Despite paragraph (1)(e) and subsection 7(2), subsection (1) of this section applies to a person who is the nominated representative of the healthcare recipient.